1

Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks fine and goes to Imgur, when I click again. I turned off all unreliable Chrome /extensions and see no new /plugins. Greping the extensions directory also didn't show me anything about "avia".

The only thread I've found on this is https://forums.malwarebytes.org/index.php?/topic/161783-home-network-hijacked-popupredirect-on-multiple-devices/page-2 where malware was probably in the router. I've checked settings -- DNS is set to default, so if it's in router, it odes not show up so easily. And my neighbour, using the same network via Windows 7, says he doesn't have my issue.

So the next thing I want to try to find the buster is to track hosts, that my browser accesses -- maybe it will show up at the moment before going the Aviasales website. How do I do it? Tcpdump? I want to get the list looking somehow like:

[timestamp]: IP
[timestamp]: IP
[timestamp]: IP
  • 1
    Netstat and tcpdump can do it from the same machine, but a good rootkit should be able to hide from them so the only real way to be sure is to run tcpdump on another machine acting as a bridge/router. – André Borie Aug 16 '15 at 10:47
  • @AndréB. When you would add some instructions how to set this up, you could post this as an answer. – Philipp Aug 16 '15 at 11:12
  • 1
    First track potential modifications of your /etc/resolv.conf. /bin/ls & /usr/bin/diff may help you even if some admin commands have been tempered by a rootkit. Next check that you are really connected through the interface you think you should (beware of the Automatic configuration nightmare, and that your neighbour Wi-Fi router might be your problem). – dan Aug 16 '15 at 17:44
1

To track outbound connections from your system, likely the best approach would be to use software like Little Snitch for Mac OSX or Glasswire for Windows which can log these connections and also alert/block as needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.